What is BrowserSafeguard?

I recently downloaded a media player called TinyMediaPlayer and was offered to install the BrowserSafeguard program. According to the offer the program was free and would protect my PC from malware. However the software has severely altered my Firefox browser and looks like it added adware to my browser. What exactly does BrowserSafeguard do and how does it work?

adware BrowserSafeguard

Asked May 8 '14 at 15:31

Chris Mueller

115

Add a comment

3 Answers

BrowserSafeguard is a program that bills itself as being able to 'protect' a user's web browser from malicious URLs and prevents a user from visiting such web sites. While in theory this is what the software does, in doing so it has been seen to have very negative impact on the PC's overall performance and security.

BrowserSafeguard installs a local proxy server that all browsers must utilize in order to connect to the internet. Using an embedded Fiddler engine (web debugging proxy which logs all HTTP) it traps all traffic going through the Internet from the browser and analyzes it. While the privacy policy does not get into full details, this is very concerning as it is able to analyze the entire stream of data the user makes, from shopping to banking, this also includes SSL (https) traffic. In order to use Fiddler it will install install a root certificate (DO_NOT_TRUST_FiddlerRoot) on the PC.

As for how it technically works, there are a number of files it installs in C:\Program Files\Browsersafeguard:

BrowserSafeguard.exe - this is the local proxy server that listens and traps all Internet traffic to and from the web browser. It also has a small GUI interface that runs in the system tray to manage some settings.
uninstall.BrowserSafeguard.exe - this is the installer module and the uninstaller. It runs an a scheduled task daily (and every 6 hours) to make sure the system is running and if not it will re-install all the settings including the proxy regardless if the user manually disabled the proxy in the Internet Settings utility. If the user deletes BrowserSafeguard.exe, this process when run will extract an installer module (install.exe) and will re-download and install any modified settings including the BrowserSafeguard.exe service. This file also contains a number of embedded resources to perform various protection actions and task scheduling. It will also install the trusted root cert.
makecert.exe - this is a standard Microsoft file that is used to install the trusted root certificate.
TrustedRoot.cer - this is the root certificate that is installed.
C:\Program Files\Browsersafeguard\Resources - the Resources folder there are a bunch of common libraries used by the program.
ewebstorewrapper.dll - used for supporting registration (for the paid version) through the ValidateSerialNumber function.

In addition its means of installation is very sketchy as it is typically installed with a number of 3rd-party download managers/ installers from Adknowledge (and others) such as:

WARP INSTALL (downloader.browsersinfo.com)
Ez-download (ez-downlaod.com)
OutBrowse (app2desktop.com)
FUSION INSTALL (secure.2-fusioninstall.com)
SETUP DOT EXE (secure.6-fusioninstall.com)

Also there is a catch, the free version (the one that is bundled is ad-supported, meaning it will inject various forms of advertisements in the web browser), while the paid version will not. However the free version never expires as I suppose they make some decent money off of displaying ads.

The ad-supported version will add a plugin/extension in Firefox/Chrome/IE and connect to http://www.playbryte.com for tracking and instructions.

If you would like to see what BrowserSafeguard is doing, in the system tray show the BrowserSafeguard.exe UI and anywhere on the windows hold down Ctrl-d and this will launch the debug window.

Edited on May 8 '14 at 15:57

Answered May 8 '14 at 15:57

Joeyc

149

Add a comment

Short answer: it is a freeware that claims to secure your online activities by preventing you from visiting malicious sites.

Personal Opinions: I have never installed this software but if ever I do, I prefer to do so through their official site only and never through offers in installation of another software, because this is most common cause of spreading of malware and spamming softwares.

Alternatives: I use Web of Trust (or WoT) chrome plugin that uses huge user base and advanced database to gather knowledge about malicious sites and prevents me from visiting such sites. It even shows whuch links on any given page are okay and which are harmful by displaying an icon. I can ignore it to download from a trusted site but if I download a malware, I have to use an antivirus to remove it.

Answered May 10 '14 at 8:58

utg001

Add a comment

I highly recommend you to unistall completely that piece of software. It has more disadvantages than advantages.

Answered May 31 '14 at 16:24

Gin

Add a comment

Know someone who can answer? Share a link to this question via email, Google+, Twitter, or Facebook.

Your Answer

Not the answer you're looking for? Ask your own question.

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.